Question

A financial services company must ensure that audit log files stored in Amazon S3 cannot be deleted or overwritten by anyone—including the AWS account root user and administrators—for a mandatory 7-year retention period to satisfy regulatory requirements and protect against ransomware. Which configuration meets these requirements?

Accepted Answer

Enable S3 Object Lock in compliance mode with a 7-year default retention period on the bucket at creation time.

Answer

Enable S3 Object Lock in governance mode with a 7-year retention period and grant the s3:BypassGovernanceRetention permission only to administrators.

Answer

Apply an S3 bucket policy that denies s3:DeleteObject and s3:PutObject for all principals, combined with S3 Versioning.

Answer

Enable S3 Versioning with an MFA delete requirement and a lifecycle policy that transitions objects to S3 Glacier Deep Archive for 7 years.